---
title: "Google Cloud"
slug: "google-cloud"
description: "Customer-facing setup instructions: what a Google Cloud administrator must configure, and which values to enter into Clarity."
status: "new"
updated: 2026-10-27T16:29:29Z
published: 2026-10-27T16:29:29Z
canonical: "help.claritysecurity.com/google-cloud"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud

## Overview

The Clarity Google Cloud connector is **read-only**. It never writes to Google Cloud. It reads who holds which IAM role, and where, across your whole organization.

| What Clarity syncs | Google source | How it appears in Clarity |
| --- | --- | --- |
| Every IAM role binding on the organization, every folder and every project | Cloud Asset Inventory (IAM policies), one sweep per sync | One entitlement per binding, named {role} @ {org}/{folder…}/{project} |
| Who holds each binding: users, service accounts, allUsers, allAuthenticatedUsers, domain:, workload / workforce identity pools | The binding’s members | Accounts on the application, each granted the binding |
| Deleted principals still listed on a binding | The binding’s members | Inactive accounts. They are not counted as current access. |
| Every Google group in your Cloud Identity / Workspace account | Cloud Identity groups, once per sync | A group entitlement, whether or not it holds a binding |
| Members of the groups that hold a binding (including nested groups) | Cloud Identity group memberships | Its members inherit the group’s bindings |
| Service accounts and their keys | IAM, per active project | Non-human identities (type **Service Account**) with their keys as credentials |
| The permissions inside **custom** roles | IAM roles | The binding’s Permissions tab |
| Organization, folder and project names | Resource Manager | The node path in each entitlement name |

**Conditional bindings** are kept:

- A binding limited to a time window shows [until YYYY-MM-DD] while it is open.
- Once the window has passed it shows [expired YYYY-MM-DD]. An expired binding is kept and lists who held it, but it is **not** counted as current access and never appears as live access in a review.
- A window that has not started yet shows [not active until YYYY-MM-DD]. It is kept as pending: not current access, and not expired.
- Any other condition shows [conditional: <title>], and the rule is kept exactly as written.

The basic roles **Owner, Editor and Viewer** are tagged **high risk** by Clarity’s Google Cloud tag rules.

## Prerequisites

You need:

- A Google Cloud administrator who can create a service account and key in one project, and grant IAM roles at the **organization** level (for example, an Organization Administrator).
- A Google Workspace / Cloud Identity **super administrator**, to assign the Groups Reader admin role in the Google Admin console.
- Your numeric Google Cloud **organization ID**.

**Note:** Many Google Cloud organizations block service account key creation through the organization policy **Disable service account key creation**. If Google refuses to create the key in Step 1, an Organization Policy Administrator must allow key creation for the project that hosts the Clarity service account.

## Step 1 — Create a read-only service account

In the Google Cloud console, choose a project to host the connector’s service account (any project in the organization).

1. **IAM & Admin → Service Accounts → Create service account.** Name it, for example, clarity-reader. Grant it **no** roles on this screen.
2. Open the new account → **Keys → Add key → Create new key → JSON**. A JSON key file downloads. Treat it like a password: it is the only credential Clarity needs.
3. Make sure these APIs are enabled on that host project (**APIs & Services → Library**):
  - **Cloud Asset API**
  - **Cloud Resource Manager API**
  - **Identity and Access Management (IAM) API**
  - **Cloud Identity API**

## Step 2 — Grant the service account read roles on the organization

At the **organization** node (**IAM & Admin → IAM**, with the organization selected), grant the service account:

| Role | Why |
| --- | --- |
| **Cloud Asset Viewer** (roles/cloudasset.viewer) | Reads every IAM policy in one sweep |
| **Security Reviewer** (roles/iam.securityReviewer) | Reads custom roles and IAM policies |
| **Browser** (roles/browser) | Reads organization, folder and project names |
| **Service Account Viewer** (roles/iam.serviceAccountViewer) | Lists service accounts and their keys |

None of these roles can change anything.

## Step 3 — Let the service account read Google groups

In the **Google Admin console** (admin.google.com): **Account → Admin roles → Groups Reader → Assign service accounts**, and add the service account’s email address.

Without Groups Reader, no group can be read and the sync fails with:

*Cloud Identity groups unreadable: check the service account’s Groups Reader role*

A single group Clarity cannot read (for example, one owned by another organization) still appears as an entitlement, but its members are not read.

## Step 4 — Enter the credentials in Clarity

**Applications → Add application → Google Cloud.**

| Clarity field | Value |
| --- | --- |
| **Service Account JSON Key** | Paste the whole contents of the JSON key file. The field is masked, stored encrypted, and never shown again. To replace the key, paste a new one. |
| **Organization ID** | The numeric organization ID (for example 123456789012), from the console’s organization picker or gcloud organizations list. organizations/123456789012 is also accepted. |
| **Cloud Identity Customer ID** | Optional. Your Workspace / Cloud Identity customer ID (for example C01234567), used to list your groups. When empty, Clarity uses the customer that owns the organization. |

Click **Next**. This will automatically trigger a test that reads the organization and one page of IAM policies. A failure here usually means the organization ID is wrong, or the **Browser** or **Cloud Asset Viewer** role is missing at the organization.

![](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/image-YEI9MTCC.png?sv=2026-02-06&spr=https&st=2026-10-28T09%3A04%3A37Z&se=2026-10-28T10%3A04%3A37Z&sr=c&sp=r&sig=60EDELssmgASc5D0VHBi5bMrlHdux3ddJNTZp%2BB9Cxk%3D)

## What to expect

- **Names follow renames and moves.** Each entitlement is keyed to the role plus the node’s numeric ID. When a folder is renamed or a project moves, the entitlement’s name changes, but its tags, review history and requests stay with it.
- **Changing a condition creates a new entitlement.** Google treats a binding with a different condition as a different binding, so a changed condition appears as a new entitlement, and the old one is retired.
- **Holders that are not people** (allUsers, allAuthenticatedUsers, domain:, identity pools, whole-customer group members) appear as accounts named, for example, *Anyone on the internet* or *Domain example.com*. They are never matched to a person, so they show up as unreconciled accounts in reviews. That is how a public or domain-wide grant reaches a reviewer.
- **One locked-down project stops the sync.** If the service account cannot list the service accounts of a project (for example, inside a VPC Service Controls perimeter), the sync fails rather than treating that project’s accounts as removed. Grant Service Account Viewer there, or add the connector’s project to the perimeter.

## What Clarity does NOT do

- **No changes in Google Cloud.** Clarity never adds, removes or changes a binding, a group or a service account.
- **Not synced in this version:** individual resources (buckets, VMs and so on) and the organization tree as its own objects, deny policies, GKE / Kubernetes RBAC, the permissions inside Google’s predefined roles, Organization Policy, and VPC Service Controls.

## Need Help?

If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST.

## Related

- [Google Workspace](/google-workspace.md)
- [Google Ads](/google-ads.md)